Privacy-preserving authentication solutions - best practices for implementation and EU regulatory perspectives

Privacy-preserving authentication solutions minimize the use of personal data of a user in an authentication process and can best be implemented with attribute-based credentials, in short: Privacy-ABCs. This technology allows not only for a reduction of personal data processed, but also conditional identification and the revocation of credentials. In order to fully benefit from their potential, implementation must be centered on the users' rights. Even though this can already be achieved, Privacy-ABCs are not explicitly taken into account in the current legal framework on identification and authentication, in particular the forthcoming eIDAS Regulation. Nevertheless, their potential to enhance current eID solutions can still be harnessed and should be incorporated increasingly in future legislation. For employment as best practice solutions, privacy-preserving authentication solutions have to be embedded in a suitable process framework within the organization as exemplarily sketched in this contribution.